Privacy Policy

Last updated: 9 November 2026.

This policy explains how BRACE – Empowering Communities handles personal information on this website, in its supporter records and in the work it does with residents. It replaces the policy published on BRACE's former website (last updated 8 June 2025).

Who we are

BRACE (A Company set up under section 42 of the Companies Act, 2017), a not-for-profit company licensed by the Securities and Exchange Commission of Pakistan and incorporated on 8 July 2025. Its registered office, company number (CUIN) and licence number are shown at the foot of every page of this website. You can reach BRACE about anything in this policy through the Contact page.

What we collect, and when

• When you register as a supporter: your name, email address, mobile number and CNIC number; the housing schemes or communities you are connected with and how (owner, tenant, resident); your addresses; and, if you pay a contribution, its amount, date, method, transaction reference and the receipt you upload.
• On your own supporter page ("My support"): the corrections you ask for, payments you report, expense claims and their receipts, and the matters you follow.
• When you report a case: what you tell us and the evidence you attach. You may file confidentially, or anonymously, in which case no name or contact detail is kept and BRACE cannot reply to you.
• When you use the contact form: your name, email address, phone number if you give it, and your message.
• When you volunteer or take part in an election: your offer and activities; for an election, whether you voted. How you voted is never linked to you.
• Your account: the email you sign in with and your password, which is stored only in a form that cannot be read back. Staff accounts also use two-step sign-in.
• From BRACE's former website: supporters who registered there have their earlier registration and payment records carried over, each value marked with where it came from.

We do not use advertising or tracking tools, and we do not build profiles of visitors. See Cookies.

Why we use it

• to keep an accurate record of BRACE's supporters and of every contribution, and to verify payments;
• to handle the cases you report, and to follow up with institutions on residents' behalf;
• to send you what you asked for: replies, receipts, reminders, and updates on matters you follow;
• to run BRACE as a company: its accounts, meetings, elections and the records the law requires;
• to keep the platform secure and to show who did what in an audit record.

We do not sell, rent or trade personal information, and we do not use it for anyone else's marketing.

Who can see it

• BRACE's staff and office holders see only what their role needs. Each permission is checked by the system on every action, and every change is recorded.
• BRACE's administrators may save supporters' names, Supporter IDs, mobile numbers, email addresses and places as contacts on their own phones, so that they recognise supporters in BRACE's WhatsApp groups. Each such download is recorded, and the file is not to be shared. CNIC numbers and dates of birth are never included.
• Who filed an anonymous case is withheld from those handling it; only BRACE's Superadmin can see it. If you file anonymously on the public form, no name is kept at all. A confidential case is seen only by those handling it and the Superadmin.
• The public sees only what BRACE publishes after review: for example the names of its office bearers, its own work and its documents with personal details removed, and case figures as totals, with small numbers hidden so that no one can be singled out. A complainant's details are never published.

Who else handles it

• Hosting and email: the website, its database and its email run on Hostinger's servers.
• Fonts: pages load their typefaces from Google Fonts, so your browser contacts Google when a page opens.
• Banks and wallets: when you pay BRACE, your bank or mobile wallet processes the payment under its own terms. BRACE does not take card payments on this website.
• WhatsApp: BRACE's emails invite supporters to its WhatsApp groups. If you join one, WhatsApp handles your number and your messages under its own terms, and the group's other members can see your number.
• Social media: the links to BRACE's pages on Facebook, X, YouTube and TikTok take you to those services, which then apply their own policies.
• When the law requires it: for example a court order, BRACE may have to disclose information to an authority.

How it is protected

• names, contact details, CNIC numbers and messages are stored encrypted;
• a CNIC is matched by a one-way fingerprint, so records can be checked for duplicates without showing the number;
• uploaded documents are kept privately and opened only by people allowed to see them;
• the audit record cannot be altered, and it shows any attempt to change it;
• pages reach you over an encrypted (https) connection.

How long we keep it

Your supporter record is kept while you support BRACE, and afterwards for as long as BRACE's accounts and company records need it, unless you ask us to delete it. Payments BRACE has confirmed, and the audit log, are kept, because the accounts must stay complete: a wrong payment is corrected by a further record. Only an entry made by mistake, such as a payment recorded twice or a test entry, is removed, and the audit log notes that it was. BRACE is setting a retention period for CNIC numbers; until it does, they are kept with the supporter record, and this policy will be updated when the period is decided.

Your choices and rights

• See what we hold: sign in and open "My support". It shows every detail BRACE holds that is yours to see, including every payment and receipt.
• Correct it: each detail on "My support" has a way to ask for a correction. A person at BRACE reviews each request.
• Get a copy, or ask us to remove something: write to us through the Contact page. We remove what we can; what the accounts or the law require us to keep, we tell you about.
• Delete your account and data: sign in, open "My support", then "My record", and ask BRACE to delete them. BRACE's Superadmin deletes your record and what goes with it, and your sign-in stops working. Payments BRACE has confirmed stay in its accounts, with their receipts, no longer linked to your record or contact details; the audit log keeps a note that the deletion happened, not your details; and records the law requires, such as the register of members of the company, are kept. BRACE tells you what it kept.
• Stop messages: stop following a matter from its page or from the link in any update email, or ask us through the Contact page to stop other messages.

Children

This website and supporter registration are meant for adults. If you think BRACE holds information about a child without a parent's or guardian's agreement, please tell us through the Contact page and we will look into it.

Changes to this policy

Each version of this policy is dated. When you register, the version you agreed to is recorded with your registration. If BRACE changes how it uses personal information, it will publish a new version here first.